Race Condition

Affecting openjdk-jre package, versions [11.0.0,11.0.9) || [15.0.0,15.0.1)

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

openjdk-jre is a free and open-source implementation of the Java Platform, Standard Edition (Java SE).

Affected versions of this package are vulnerable to Race Condition. It was discovered that the NIO Buffer implementation in the Libraries component of OpenJDK contained a race condition affecting boundary checks. An untrusted Java application or applet could use this flaw to bypass certain Java sandbox restrictions.

Remediation

Upgrade openjdk-jre to version 11.0.9, 15.0.1 or higher.

References

CVSS Score

5.3
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    Low
  • Integrity
    None
  • Availability
    None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Credit
Unknown
CVE
CVE-2020-14803
CWE
CWE-362
Snyk ID
SNYK-UPSTREAM-OPENJDKJRE-1020119
Disclosed
20 Oct, 2020
Published
21 Oct, 2020